Call us now:
Federal contractors may find that their obligations to meet cybersecurity requirements getting harder. As the GSA and the DoD move ahead with cybersecurity risk management requirements as part of compliance to Federal Contracts.
While the enclosed article seems to imply that compliance is not that complex, time consuming or difficult. One would keep an eye to be placed on the False Claims Act, and the legal challenges for failing to comply with cybersecurity risk management. A contract that has to comply with OASIS+ or DFARS 252.204-7012 is required to demonstrate oversight and assurance over a broad range of cybersecurity controls.
OASIS+ (https://lnkd.in/eFhYK-TQ) from the GSA sets out basic cybersecurity requirements for Federal contractors including Small, Woman Owned and Veteran Owned businesses under J-3 Cybersecurity and Supply Chain Risk Management (C-SCRM) Deliverables (https://lnkd.in/eRXJthfE).
Deliverables that require contractors to comply to cybersecurity requirements as defined in FAR 52.204-21 (https://lnkd.in/evmDJAE4).
One expects many contractors will find it difficult to comply with some of these requirements. Requirements that set out contractual requirements for contractors to demonstrate compliance to least privilege, network security including segregation, physical security, vulnerability and patch management and systems monitoring. All valid controls but costly to implement, oversight and assure. Requiring knowledge, skills and experience given the implications for compliance.
@Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA Ryan Buckner
Veritas GRC GSA
#cybersecurity #cyberriskmanagement #cyberlegal #oasis+
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7228721981490110465